European AML Compliance · AMLR
Article 18 AMLR (Regulation (EU) 2024/1624) lets you outsource AML/CFT tasks, but it bars six of them outright. Whether a task is barred depends on how the norm is worded — final act, preparation or the act itself — not on its subject.
Four of the six barred letters catch only the final act — an approval or a decision. Letter (a) also reaches the proposal, and letter (e) bars the report itself. Treat these three drafting types alike and you either leave relief unused or breach Article 18 AMLR.
Regulation (EU) 2024/1624 applies directly from 10 July 2027, and with it Article 18 AMLR. Until then you decide which of today’s arrangements can continue and which you need to bring back in-house.
Principle
Under Article 18(2) a service provider is regarded as part of the obliged entity when it performs outsourced tasks, and you remain fully liable for every act and omission. You must also be able to show your supervisor that you understand the approach for each task. Notification comes first: you notify before the provider starts.
Article 18 AMLR barred list
Article 18(3) lists six tasks that may not be outsourced under any circumstances. Four catch only the final act, letter (a) also the proposal, letter (e) the report itself. The single exception sits in letter (e) and needs three conditions at once.
Role
Article 11(2) has the management body appoint the compliance officer, and the officer is the role responsible for FIU reporting under Article 69(6). Whether an external individual can be appointed, and whether that counts as outsourcing, the Regulation does not state expressly. AMLA’s guidelines under Article 18(8) are due by 10 July 2027.
Next to Article 18 AMLR
The EBA published its final third-party risk guidelines in September 2026, and AMLA submitted final draft RTS on group-wide requirements in October 2026. Both deserve a check against your outsourcing register.
Article 18 AMLR, in its first paragraph, allows obliged entities to outsource tasks arising from the Regulation to service providers. It requires no approval, but it does require notification: you tell your supervisor of the outsourcing before the provider starts the task.
Under Article 18 AMLR, paragraph 2 draws three consequences. The provider is regarded as part of the obliged entity when it performs the task, including when it consults the central beneficial ownership registers for customer due diligence. You remain fully liable for any act or omission connected with the outsourced tasks. And for each outsourced task you must be able to show your supervisor that you understand the rationale behind the activities and the approach followed, and that they mitigate the specific risks you are exposed to.
Recital 47 draws a line that can save you effort. Procedures or arrangements that help you meet a requirement, where the requirement itself is not performed by a provider, are not treated as outsourcing. The recital names the use or purchase of third-party software, access to databases and access to screening services.
It adds that providers who are not themselves subject to AML/CFT rules owe obligations only under the contract, not under the Regulation. Responsibility stays entirely with you.
Recital 48 supplies the thought behind every borderline case: the final decisions on measures that affect how policies, procedures and controls are implemented should always rest with the obliged entity. A recital is not an operative provision, but it explains why the barred list in paragraph 3 is cut the way it is.
Recital 49 corrects a common assumption. Notifying an outsourcing arrangement does not mean the supervisor accepts it. The information can still feed into the assessment of your systems and controls, your residual risk profile and the preparation of inspections — notably where critical functions are outsourced or outsourcing is systematic.
Article 18 AMLR sets two limits in paragraph 3. Outsourced tasks must not materially impair the quality of your policies and procedures or of the controls that test them, and six tasks are barred entirely.
| Letter | Barred | Drafting type | Reference |
|---|---|---|---|
| a | the proposal and the approval of the business-wide risk assessment | Preparation and final act | Art. 18(3)(a), Art. 10(2) |
| b | the approval of the internal policies, procedures and controls | Final act | Art. 18(3)(b), Art. 9 |
| c | the decision on the risk profile attributed to the customer | Final act | Art. 18(3)(c) |
| d | the decision to enter into a business relationship or to carry out an occasional transaction | Final act | Art. 18(3)(d) |
| e | the reporting to the FIU of suspicious activities, and threshold-based reports | The act itself | Art. 18(3)(e), Art. 69, 74, 80 |
| f | the approval of the criteria for detecting suspicious or unusual transactions and activities | Final act | Art. 18(3)(f) |
The list is not uniform, and that is its practical value. Four of the six letters — (b), (c), (d) and (f) — catch only the final act: approval or decision. Everything before it — data collection, analysis, assessment proposals, drafting — stays outsourceable there. Letter (a) reaches into preparation by barring the proposal as well as the approval. Letter (e) names a different object: not a decision about reporting but the reporting itself.
Because the Regulation words approvals and decisions in four letters and an act only here, it is hard to read letter (e) as barring only the decision whether to report. The bar attaches to the report.
Only letter (e) has an exception. You may outsource to another obliged entity that belongs to the same group and is established in the same Member State. All three conditions must be met together: a provider that is not an obliged entity, or a group company in another Member State, does not qualify.
Article 18 AMLR adds a separate rule in paragraph 7. A collective investment undertaking without legal personality, or with only a board of directors, that has delegated the processing of subscriptions and the collection of funds may outsource the tasks in letters (c), (d) and (e) to one of its service providers. This takes effect only after notification and the supervisor’s approval, which takes the provider’s resources, experience and AML/CFT knowledge into account, as well as its knowledge of the undertaking’s activities.
A common description says a provider prepares drafts of the business-wide risk assessment. That does not hold against the wording: both the proposal and the approval are barred. Article 10(2) resolves it: the assessment is drawn up by the compliance officer and approved by the management body in its management function. Whoever drafts it must therefore be the appointed compliance officer — which moves the question from outsourcing to appointment.
The Article 18 AMLR barred list says what is not possible. In practice the counter-check matters: which work on the same task remains permitted? The six cards below go through the letters one by one.
The cards assume that the management body has appointed a named individual as compliance officer and that this individual is employed by an external provider. Where the Regulation assigns a task to the compliance officer, that person acts personally. This covers drawing up the business-wide risk assessment under Article 10(2) and the FIU reporting under Article 11(2) and Article 69(6).
Whether appointing an external individual is outsourcing under Article 18 AMLR or the staffing of a function under Article 11 is not answered expressly. Recital 50 and Article 18(8) task AMLA with guidelines on outsourcing, including the roles and responsibilities of the obliged entity and the provider. Until they exist, the reading used here is a reasoned position, not settled law.
The compliance officer drafts the proposal, because Article 10(2) assigns the drawing-up to that role. Inputs can be supplied: data, risk indicators, methodology, analysis and plausibility checks. Keep the input distinguishable from the proposal: the larger the supplied share, the weaker the case for personal authorship. Approval stays with the management body in its management function.
Drafting with the officer
Drafting, gap analysis against the Regulation, updating, version control and submission for approval remain outsourceable. Only the approval act is barred. Under Article 9(2) policies are approved by the management body in its management function; procedures and controls at least at the level of the compliance manager.
Draft yes, approval no
Running and calibrating the rating model, collecting risk factors, preparing a rating proposal, review cycles and documentation remain outsourceable. Letter (c) does not say who decides in your house; fix that in your customer acceptance policy.
Decision level set internally
Identification, beneficial owner checks, screening, completeness and plausibility checks, preparing the file until it is ready for decision, and follow-up management remain outsourceable. Letter (d) does not name the deciding level either.
Decision level set internally
Monitoring, alert handling, fact-finding, the case file, the draft report with reasoning and annexes, and deadline tracking remain outsourceable. The report is filed by the appointed compliance officer, because Article 11(2) makes that role responsible for reporting under Article 69(6). The exception in letter (e) helps only with a provider that is an obliged entity of the same group in the same Member State.
Filing tied to the role
Deriving scenarios, thresholds and parameters, tuning, back-testing, impact analysis, calibration documentation and submission for approval remain outsourceable. Letter (f) names no approval level. Applying the compliance manager level as a minimum is an inference from letter (b) and Article 9(2), not a rule.
Draft yes, approval no
The picture reduces to one line: what is barred is the approval and decision level, and it sits in-house. What precedes it stays outsourceable, provided the contribution can be told apart from the decision in your documentation.
Article 9(2) and Article 10(2) put approval on different levels. The terms are defined in Article 2(37) to (40) and they blur easily.
| Level | Who that is | Approves or draws up | Reference |
|---|---|---|---|
| Management body in its management function | the management body responsible for the day-to-day management of the obliged entity | approves the internal policies and the business-wide risk assessment | Art. 9(2); Art. 10(2); Art. 2(38) |
| Compliance manager | one member of the management body in its management function | approves procedures and controls — as a minimum level, not a ceiling | Art. 9(2); Art. 11(1) |
| Compliance officer | appointed by the management body in its management function, with sufficiently high hierarchical standing | draws up the business-wide risk assessment, but does not approve it | Art. 10(2); Art. 11(2) |
| Senior management | members of the management body in its management function as well as officers and employees with sufficient knowledge and seniority | no approval reservation in Article 9 or 10; the term widens the circle where the Regulation uses it | Art. 2(40) |
If policies, procedures and controls sit in one document with one signature, you can no longer show that each was approved at the right level. Separating the documents is therefore the precondition for the evidence, not a formality.
Inference, not a ruleLetter (f) names no approval level and does not refer to Article 9. Applying the compliance manager level as a minimum is consistent with letter (b), but it remains an inference. Letters (c) and (d) do not say who decides either; that is for your customer acceptance policy.
Many accounts treat the compliance officer as a bundle of tasks that can be distributed. The AMLR constitutes the officer as a function to be filled: under Article 11(2) the management body in its management function appoints the officer; a provider does not supply one. The difference between those two verbs carries the whole boundary.
This section stays short on purpose. For the wider picture of the role, see our page on Article 11 AMLR: first steps and duties under Article 11
Read with Article 18(3)(e), Article 11(2) gives a consistent picture: the report cannot be outsourced, and the role responsible for it is the appointed compliance officer.
The Regulation does not state expressly whether an external individual can be appointed as compliance officer or whether such an appointment falls under the bar in Article 18 AMLR. Recital 50 and Article 18(8)(b) task AMLA with guidelines on the roles and responsibilities of obliged entity and provider; they are due by 10 July 2027.
The position taken here: appointment under Article 11(2) is an organisational act of the management body and not outsourcing under Article 18 AMLR, because the appointed person becomes part of the organisation instead of acting for it as a third party. That is interpretation. Treat it as such until AMLA’s guidelines are available, and clarify it with your supervisor before you rely on it.
In Germany, § 7 GwG governs the appointment today; how it continues alongside the Regulation after 10 July 2027 depends on national legislation, and we have not confirmed a final act.
A task that is not barred is not free. Paragraphs 4 to 8 set what applies before, during and beyond the Union’s borders, and what AMLA will add.
Article 18(4)
Before outsourcing you must assure yourself that the provider is sufficiently qualified. The provider and any subsequent sub-outsourcing provider apply your policies and procedures, not their own. The conditions are laid down in a written agreement. You perform regular controls; their frequency follows the critical nature of the outsourced tasks.
Article 18(5)
Outsourcing must not materially impair your supervisors’ ability to monitor and retrace your compliance with the Regulation and with Regulation (EU) 2023/1113. That is the yardstick for information, access and audit rights in the contract.
Article 18(6)
You may not outsource to providers residing or established in third countries identified under Chapter III, Section 2, unless all of three conditions are met: you outsource solely to a provider that is part of your group; the group applies AML/CFT policies, due diligence and record-keeping fully in line with the Regulation or with equivalent third-country rules; and effective implementation is supervised at group level by the supervisory authority of the home Member State.
Article 18(8)
By 10 July 2027 AMLA must issue guidelines on setting up outsourcing relationships, including sub-outsourcing, their governance and monitoring, in particular for critical functions; on the roles and responsibilities of the obliged entity and the provider; and on supervisory approaches and expectations for the outsourcing of critical functions.
Precision on termsParagraph 6 does not speak of high-risk third countries but of third countries identified pursuant to Section 2 of Chapter III. Comparing the barrier with an existing high-risk list means checking the wrong set.
The Article 18 AMLR debate is about which tasks you may hand over. A separate stream concerns the scope of the group rules. AMLA consulted between 16 April and 15 June 2026 on draft regulatory technical standards under Article 16(4) and Article 17(3) AMLR and, according to the Luxembourg supervisor CSSF, submitted the final draft RTS to the European Commission in October 2026.
As reported, the final draft extends group-wide requirements to structures other than groups where two or more obliged entities share common ownership, management or compliance control. Which features amount to common compliance control is set out in AMLA’s final report; read those criteria before you assume anything either way for your own arrangements, particularly if one compliance service is shared across several entities.
Procedural statusThese are draft standards submitted for adoption, not applicable law. The Commission still has to adopt them, and they must be published in the Official Journal before they apply. Cite them internally as drafts. For group structures in general, see our page on group AML governance.
Entries in red are still ahead. The others have already happened and apply today.
The AMLR enters into force. Article 90 sets its application from 10 July 2027.
AMLA consults on the draft RTS for group-wide requirements (Articles 16(4) and 17(3)).
Statutory deadline for AMLA’s first guidelines on internal policies, procedures and controls (Article 9) and on the business-wide risk assessment (Article 10). Check AMLA’s publications for the status of each.
The EBA publishes its final Guidelines on the sound management of third-party risk (EBA/GL/2026/09), designed to replace the 2019 outsourcing guidelines, with a two-year transitional period.
AMLA submits the final draft RTS on group-wide requirements to the Commission.
Commission adoption of the group-wide RTS and publication in the Official Journal. No date is fixed.still open
The AMLR applies. Article 18 AMLR binds from this day, including the barred list, and AMLA’s outsourcing guidelines under paragraph 8 are due by then.still open
The following 6 findings recur regardless of size and business model. They do not replace a review of your own house.
A common formulation says only the outsourcing of the decision to report is barred. The wording bars the report itself. That the legislator speaks of approval or decision in four letters and of an act only here cannot be treated as an editing slip.
Art. 18(3)(e)
Both the proposal and the approval of the business-wide risk assessment are barred. A provider that delivers drafts delivers the proposal. Article 10(2) points to the compliance officer as the author.
Art. 18(3)(a), Art. 10(2)
Policies, procedures and controls often sit in one document. The AMLR separates them: policies are approved by the management body in its management function, procedures and controls at least by the compliance manager. Without separate documentation the right level cannot be shown.
Art. 9(2), Art. 2(37)–(40)
Recital 49 states that notifying an arrangement does not mean it is accepted. The notified information can feed into the supervisor’s assessment of your systems and controls, your residual risk profile and the preparation of inspections.
Art. 18(1), recital 49
Recital 47 excludes the use or purchase of third-party software, database access and screening services. Notifying them creates correspondence without cause and dilutes your outsourcing register. The reverse error also exists: a provider that performs the requirement is outsourcing, whatever the tool.
Recital 47
Agreements signed or renewed now will run past 10 July 2027. Without a clause for AMLA’s guidelines and for the sub-outsourcing and written-agreement rules of Article 18(4), you renegotiate under time pressure.
Art. 18(4), Art. 18(8)
Select a status for each question. Nothing is stored or transmitted; the Article 18 AMLR check is a self-assessment ahead of 10 July 2027.
Has every existing outsourcing been notified to your supervisor before the provider began the task?Art. 18(1)
Can you show, for each outsourced task, that you understand the approach and that it mitigates your specific risks?Art. 18(2)
Does the contract make clear that reporting to the FIU is not outsourced?Art. 18(3)(e)
Does the appointed compliance officer draw up the business-wide risk assessment personally?Art. 10(2), Art. 18(3)(a)
Are policies, and procedures and controls, documented separately and approved at the right level?Art. 9(2)
Do contracts that run beyond 10 July 2027 allow adjustment once AMLA’s outsourcing guidelines are published?Art. 18(4), Art. 18(8)
These 6 steps work whichever way AMLA decides the open interpretation questions. They build evidence you will need anyway.
For each agreement, state which task is actually performed and assign it to letters (a) to (f). Assign by activity, not by the title of the contract.
Define who notifies what and when, and check existing contracts for whether notification preceded the start of service. Closing gaps now is cheaper than a finding later.
Separate policies from procedures and controls, assign each document an approval level and reflect the resolution in the minutes.
Write a short sheet per outsourced task: risk, procedure, effect, control point. It is the document a supervisor is likely to ask for.
Make sure the compliance officer draws up the business-wide risk assessment and files the report, and record which third-party inputs were used.
Cover written-agreement content, sub-outsourcing duties under Article 18(4) and a review mechanism for the guidelines due by 10 July 2027.
Three key messages remain.
Four of the six letters bar only the final act. Preparation, analysis and drafting remain outsourceable there. For letters (a) and (e) this is not the case.
Article 18(3)(e) bars the reporting itself. That goes beyond a reading in which only the decision whether to report is reserved to you.
Whether appointing an external individual under Article 11(2) is outsourcing under Article 18 AMLR, the Regulation does not say. AMLA’s guidelines are due by 10 July 2027.
Outsourcing AML/CFT functions stays possible under Article 18 AMLR, but it becomes more precise: preparation yes, final act no, and for the report the act itself no. If you map your outsourcing register task by task against letters (a) to (f), settle the notification path and produce the understanding evidence required by Article 18(2), you have done the part that is already fixed. What remains open is the role question, and that will be decided by AMLA’s guidelines, not by your contract.
The answers reflect the position in October 2026 and do not replace legal advice in an individual case.
Article 18 AMLR (paragraph 3 of Regulation (EU) 2024/1624) names six tasks that may not be outsourced under any circumstances: the proposal and the approval of the business-wide risk assessment, the approval of the internal policies, procedures and controls, the decision on the customer’s risk profile, the decision to enter into a business relationship or carry out an occasional transaction, the reporting of suspicious activities to the FIU together with threshold-based reports, and the approval of the criteria for detecting suspicious or unusual transactions and activities. Everything that precedes an approval or a decision remains outsourceable, except for the proposal under letter (a).
No. Under Article 18 AMLR, letter (e) bars the reporting to the FIU itself, not only the decision whether to report. The only exception applies where the activity is outsourced to another obliged entity that belongs to the same group and is established in the same Member State; all three conditions must be met together. Case handling up to the point where a report can be filed is not covered by the bar, and the report is the responsibility of the compliance officer under Article 11(2).
As a rule no. Article 18 AMLR requires you to notify the supervisor before the provider starts the task, and recital 49 states that a notification does not mean the arrangement is accepted. The one case that does need approval is Article 18(7): a collective investment undertaking without legal personality, or with only a board of directors, may outsource the tasks in letters (c), (d) and (e) only after the supervisor has approved the outsourcing.
The Regulation does not answer this expressly. Article 11(2) has the management body in its management function appoint the compliance officer, and Article 18 AMLR does not mention the appointment. Recital 50 and Article 18(8) task AMLA with guidelines on outsourcing, including the roles and responsibilities of the obliged entity and the provider; they are due by 10 July 2027. Until then, treat any reading that regards the appointment as an organisational act rather than outsourcing as interpretation and discuss it with your supervisor.
According to recital 47 it is not. Procedures or arrangements that contribute to meeting a requirement, where the requirement itself is not performed by a provider, are not treated as outsourcing. The recital names the use or purchase of third-party software, access to databases and access to screening services. What matters is whether the third party performs the requirement or only supplies the tool.
Article 18 AMLR sets the deadline in paragraph 8: by 10 July 2027 AMLA shall issue guidelines on setting up outsourcing relationships, on the roles and responsibilities of obliged entity and provider, and on supervisory expectations for the outsourcing of critical functions. We have not verified whether a consultation has been opened; check AMLA’s publications before you rely on a particular date.
Only official bodies are linked: EU legislation first, then the EBA, a national supervisor and German federal law.
Note on legal status: Regulation (EU) 2024/1624 applies from 10 July 2027 under its Article 90. The draft regulatory technical standards cited here are in the adoption procedure and are not applicable law. Check all references to provisions, deadlines and scope against the current official text. This article does not replace legal advice in an individual case.
Preparing for Article 18 AMLR touches several workstreams. These pages connect.
Where this sits in the S+P service model: the appointed compliance officer function belongs to Compliance as a Service in the second line of defence, and the operational case work on the near side of the bar belongs to 1st Line Services.
Structured preparation for 10 July 2027, from the inventory to the conversion of your approval architecture.
Group-wide requirements under Article 16 AMLR and additional measures for third-country entities under Article 17.
Monitoring, alert handling and tooling around the tasks that stay outsourceable on the near side of the bar.
The service view for institutions that look for a provider for the compliance officer function.
First steps and duties of the compliance functions that Article 18 refers back to.
Overview of our English-language pages on the EU AML package.
The German edition covers the same Regulation for DACH institutions, with references to German law and the national implementation questions.
Auslagerung von AML/CFT-Funktionen: Grenzen des Artikels 18 AMLR
Outsourcing under Article 18 AMLR is decided by the activity actually performed and by whether the norm bars the final act, the preparation or the act itself — not by the title of a contract. S+P Compliance maps your outsourcing register against letters (a) to (f), sets the approval levels under Articles 9 and 10 and builds the understanding evidence required by Article 18(2) in a form that holds up in a supervisory conversation.
Achim Schulz kennt die Führungsebene aus eigener Verantwortung – langjährig als Vorstand bei Banken und Geschäftsführer sowie als Interim-Manager in Industrieunternehmen. Diese Doppelperspektive aus Finanzsektor und Realwirtschaft prägt seine Beiträge für CEO, COO und CFO. Er kennt das Zusammenspiel von Geschäftsleitung, Aufsichtsrat und Gesellschaftern aus der Praxis und übersetzt strategische wie aufsichtsrechtliche Anforderungen in umsetzbare, haftungssichere Führungsentscheidungen – praxisnah und auf Augenhöhe mit dem Management.
LinkedIn-Profil →